Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
Reads files which store third party applications passwords
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %LOCALAPPDATA%\google\chrome\user data\default\web data
- %APPDATA%\opera software\opera stable\login data
Modifies file system
Creates the following files
- %TEMP%\tmpf009.tmp
- %TEMP%\tmpf31f.tmp
- %TEMP%\tmpf30f.tmp
- %TEMP%\tmpf30e.tmp
- %TEMP%\tmpf30d.tmp
- %TEMP%\tmpf2fc.tmp
- %TEMP%\tmpf2fb.tmp
- %TEMP%\tmpf2fa.tmp
- %TEMP%\tmpf2e9.tmp
- %TEMP%\tmpf2e8.tmp
- %TEMP%\tmpf2e7.tmp
- %TEMP%\tmpf2d7.tmp
- %TEMP%\tmpf2d6.tmp
- %TEMP%\tmpf2d5.tmp
- %TEMP%\tmpf2c4.tmp
- %TEMP%\tmpf2c3.tmp
- %TEMP%\tmpf2b3.tmp
- %TEMP%\tmpf2b2.tmp
- %TEMP%\tmpf2b1.tmp
- %TEMP%\tmpf2a0.tmp
- %TEMP%\tmpf29f.tmp
- %TEMP%\tmpf29e.tmp
- %TEMP%\tmpf28c.tmp
- %TEMP%\tmpf28d.tmp
- %TEMP%\tmpf320.tmp
- %TEMP%\tmpf321.tmp
- %TEMP%\tmpf3c4.tmp
- %TEMP%\tmpf3a3.tmp
- %TEMP%\tmpf393.tmp
- %TEMP%\tmpf392.tmp
- %TEMP%\tmpf381.tmp
- %TEMP%\tmpf380.tmp
- %TEMP%\tmpf37f.tmp
- %TEMP%\tmpf36f.tmp
- %TEMP%\tmpf36e.tmp
- %TEMP%\tmpf36d.tmp
- %TEMP%\tmpf35b.tmp
- %TEMP%\tmpf1f1.tmp
- %TEMP%\tmpf35a.tmp
- %TEMP%\tmpf359.tmp
- %TEMP%\tmpf348.tmp
- %TEMP%\tmpf347.tmp
- %TEMP%\tmpf346.tmp
- %TEMP%\tmpf336.tmp
- %TEMP%\tmpf335.tmp
- %TEMP%\tmpf334.tmp
- %TEMP%\tmpf333.tmp
- %TEMP%\tmpf322.tmp
- %TEMP%\tmpf28b.tmp
- %TEMP%\tmpf27b.tmp
- %TEMP%\tmpf27a.tmp
- %TEMP%\tmpf174.tmp
- %TEMP%\tmpf163.tmp
- %TEMP%\tmpf153.tmp
- %TEMP%\tmpf142.tmp
- %TEMP%\tmpf131.tmp
- %TEMP%\tmpf130.tmp
- %TEMP%\tmpf120.tmp
- %TEMP%\tmpf0e0.tmp
- %TEMP%\tmpf0d0.tmp
- %TEMP%\tmpf0bf.tmp
- %TEMP%\tmpf0af.tmp
- %TEMP%\tmpf0ae.tmp
- %TEMP%\tmpf09d.tmp
- %TEMP%\tmpf08c.tmp
- %TEMP%\tmpf08b.tmp
- %TEMP%\tmpf07b.tmp
- %TEMP%\tmpf06a.tmp
- %TEMP%\tmpf069.tmp
- %TEMP%\tmpf059.tmp
- %TEMP%\tmpf019.tmp
- %TEMP%\tmpf185.tmp
- %TEMP%\tmpf186.tmp
- %TEMP%\tmpf175.tmp
- %TEMP%\tmpf197.tmp
- %TEMP%\tmpf269.tmp
- %TEMP%\tmpf198.tmp
- %TEMP%\tmpf268.tmp
- %TEMP%\tmpf258.tmp
- %TEMP%\tmpf257.tmp
- %TEMP%\tmpf256.tmp
- %TEMP%\tmpf245.tmp
- %TEMP%\tmpf234.tmp
- %TEMP%\tmpf233.tmp
- %TEMP%\tmpf223.tmp
- %TEMP%\tmpf222.tmp
- %TEMP%\tmpf35c.tmp
- %TEMP%\tmpf3f3.tmp
- %TEMP%\tmpf1f0.tmp
- %TEMP%\tmpf1df.tmp
- %TEMP%\tmpf1de.tmp
- %TEMP%\tmpf1dd.tmp
- %TEMP%\tmpf1cd.tmp
- %TEMP%\tmpf1cc.tmp
- %TEMP%\tmpf1bb.tmp
- %TEMP%\tmpf1ba.tmp
- %TEMP%\tmpf1aa.tmp
- %TEMP%\tmpf1a9.tmp
- %TEMP%\tmpf202.tmp
- %TEMP%\tmpf404.tmp
Deletes the following files
- %TEMP%\tmpf019.tmp
- %TEMP%\tmpf2c3.tmp
- %TEMP%\tmpf2d5.tmp
- %TEMP%\tmpf2d7.tmp
- %TEMP%\tmpf2e8.tmp
- %TEMP%\tmpf2fa.tmp
- %TEMP%\tmpf2fc.tmp
- %TEMP%\tmpf30e.tmp
- %TEMP%\tmpf31f.tmp
- %TEMP%\tmpf321.tmp
- %TEMP%\tmpf2a0.tmp
- %TEMP%\tmpf2b2.tmp
- %TEMP%\tmpf333.tmp
- %TEMP%\tmpf348.tmp
- %TEMP%\tmpf35a.tmp
- %TEMP%\tmpf35c.tmp
- %TEMP%\tmpf36e.tmp
- %TEMP%\tmpf37f.tmp
- %TEMP%\tmpf381.tmp
- %TEMP%\tmpf393.tmp
- %TEMP%\tmpf3a3.tmp
- %TEMP%\tmpf3c4.tmp
- %TEMP%\tmpf335.tmp
- %TEMP%\tmpf346.tmp
- %TEMP%\tmpf29e.tmp
- %TEMP%\tmpf28c.tmp
- %TEMP%\tmpf27b.tmp
- %TEMP%\tmpf07b.tmp
- %TEMP%\tmpf08c.tmp
- %TEMP%\tmpf0ae.tmp
- %TEMP%\tmpf0bf.tmp
- %TEMP%\tmpf0e0.tmp
- %TEMP%\tmpf130.tmp
- %TEMP%\tmpf142.tmp
- %TEMP%\tmpf163.tmp
- %TEMP%\tmpf175.tmp
- %TEMP%\tmpf186.tmp
- %TEMP%\tmpf069.tmp
- %TEMP%\tmpf198.tmp
- %TEMP%\tmpf1bb.tmp
- %TEMP%\tmpf1cd.tmp
- %TEMP%\tmpf1de.tmp
- %TEMP%\tmpf1f0.tmp
- %TEMP%\tmpf202.tmp
- %TEMP%\tmpf223.tmp
- %TEMP%\tmpf234.tmp
- %TEMP%\tmpf256.tmp
- %TEMP%\tmpf258.tmp
- %TEMP%\tmpf269.tmp
- %TEMP%\tmpf1aa.tmp
- %TEMP%\tmpf3f3.tmp
- %TEMP%\tmpf404.tmp
Network activity
Connects to
- 'ap#.ip.sb':443
- 'wh###.iana.org':43
- 'WH###.RIPE.NET':43
TCP
HTTP POST requests
- http://je###aki.xyz/
UDP
- DNS ASK mb#.#azeni.ru
- DNS ASK je###aki.xyz
- DNS ASK ap#.ip.sb
- DNS ASK wh###.iana.org
- DNS ASK WH###.RIPE.NET
Miscellaneous
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe'
